What happens when a site is compromised
A website that is compromised can be changed without the owner knowing. The attacker may add a hidden program that infects visitors, redirect visitors to another page, or steal the data that the site collects. For visitors, the site looks normal and the infection is invisible. For the owner, the harm is loss of trust and, if personal data was exposed, legal exposure as well. The pattern has been seen on the sites of banks, companies and public bodies, and the methods have changed little: a weakness in the software, a stolen password or a poorly configured server.
The law as it applies to the attacker
The attacker commits several acts that the Information Technology Act 2000 names. Accessing the site without permission and altering its content is covered by section 43(a) and (i). Introducing a computer contaminant or virus is covered by section 43(c). Where the act is done dishonestly or fraudulently, section 66 makes it a crime with imprisonment up to three years, or a fine up to Rs 5 lakh, or both. If the malware is used to take money or credentials, sections 66C and 66D on identity theft and cheating by personation may also apply, and if the target is critical information infrastructure declared a protected system under section 70, the matter is far more serious.
The offences are listed in the guide to the IT Act 2000. A police officer not below the rank of Inspector investigates under section 78.
The duties of the site owner and host
A site owner who collects personal data has duties. Section 43A, until it is omitted, made a body corporate liable for compensation if it was negligent in keeping reasonable security practices and thereby caused wrongful loss or gain. Under the Digital Personal Data Protection Act 2023, a Data Fiduciary must take reasonable security safeguards to prevent a personal data breach and must give notice of a breach to the Board and to each affected Data Principal; the penalties go up to Rs 250 crore and Rs 200 crore respectively. The guide to the DPDP Act 2023 explains these duties.
A hosting provider is an intermediary under the Act, whose definition includes web-hosting service providers. Section 79 exempts it from liability for third party information on conditions, including due diligence and prompt action after actual knowledge or a notification from the appropriate Government or its agency to remove or disable access to the material.
What to do when a site is hacked
The owner should take the site offline or into a safe mode, keep the logs and a copy of the affected files, change all passwords, find and close the weakness before restoring the site, and report the incident. The page on computer forensics explains why copies and logs should be kept, and the guide on how to file a cyber crime complaint online sets out the reporting steps. The Indian Computer Emergency Response Team is the national agency for incident response under section 70B.